Certificate verification failed when using Envoy as an egress proxy

*Title*: Certificate verification failed when using Envoy as an egress proxy

*Description*:
I'm evaluating Envoy as an internet egress proxy with CONNECT support. Everything is working properly except when I add [the recommended configuration](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/dynamic_forward_proxy_filter) to verify upstream certificate:

```yaml
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
common_tls_context:
validation_context:
trusted_ca: {filename: /etc/ssl/certs/ca-certificates.crt}
```

When I try to call a random address with curl I have the following error:

```
❯ curl -vvv -x 127.0.0.1:10001 "https://www.google.com"
* Trying 127.0.0.1:10001...
* Connected to 127.0.0.1 (127.0.0.1) port 10001 (#0)
* allocate connect buffer
* Establish HTTP proxy tunnel to www.google.com:443
> CONNECT www.google.com:443 HTTP/1.1
> Host: www.google.com:443
> User-Agent: curl/7.88.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 OK
< date: Wed, 14 Jun 2023 14:04:03 GMT
< server: envoy
<
* CONNECT phase completed
* CONNECT tunnel established, response 200
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version
* Closing connection 0
curl: (35) LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version
```

Any idea what is wrong with my configuration?

---

Full envoy.yaml configuration:

```yaml
admin:
access_log_path: /tmp/admin_access.log
address:
socket_address:
protocol: TCP
address: 0.0.0.0
port_value: 10000
static_resources:
listeners:
- name: listener_0
address:
socket_address:
protocol: TCP
address: 0.0.0.0
port_value: 10001
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
stat_prefix: ingress_http
access_log:
- name: envoy.file_access_log
typed_config:
"@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
path: /dev/stdout
route_config:
name: local_route
virtual_hosts:
- name: local_service
domains:
- "*"
routes:
- match:
connect_matcher:
{}
route:
cluster: dynamic_forward_proxy_cluster
upgrade_configs:
- upgrade_type: CONNECT
connect_config:
{}
http_filters:
- name: envoy.filters.http.rbac
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
matcher:
matcher_list:
matchers:
- predicate:
or_matcher:
predicate:
- single_predicate:
input:
name: envoy.matching.inputs.request_headers
typed_config:
"@type": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
header_name: :authority
value_match:
exact: www.google.com:443
on_match:
action:
name: action
typed_config:
"@type": type.googleapis.com/envoy.config.rbac.v3.Action
name: allowed
action: ALLOW
on_no_match:
action:
name: action
typed_config:
"@type": type.googleapis.com/envoy.config.rbac.v3.Action
name: not-allowed
action: DENY
- name: envoy.filters.http.dynamic_forward_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig
dns_cache_config:
name: dynamic_forward_proxy_cache_config
dns_lookup_family: V4_ONLY
- name: envoy.filters.http.router
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
http2_protocol_options:
allow_connect: true
upgrade_configs:
- upgrade_type: CONNECT


clusters:
- name: dynamic_forward_proxy_cluster
lb_policy: CLUSTER_PROVIDED
cluster_type:
name: envoy.clusters.dynamic_forward_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.clusters.dynamic_forward_proxy.v3.ClusterConfig
dns_cache_config:
name: dynamic_forward_proxy_cache_config
dns_lookup_family: V4_ONLY
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
common_tls_context:
validation_context:
trusted_ca:
filename: /etc/ssl/certs/ca-certificates.crt
```

Full envoy logs:

```
envoy-envoy-1 | [2023-06-14 14:37:00.300][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf014d80 for 3600000ms, min is 3600000ms
envoy-envoy-1 | [2023-06-14 14:37:00.301][18][trace][connection] [source/common/network/connection_impl.cc:423] [C5] raising connection event 2
envoy-envoy-1 | [2023-06-14 14:37:00.301][18][debug][conn_handler] [source/extensions/listener_managers/listener_manager/active_tcp_listener.cc:155] [C5] new connection from 172.19.0.1:51394
envoy-envoy-1 | [2023-06-14 14:37:00.301][18][trace][connection] [source/common/network/connection_impl.cc:568] [C5] socket event: 3
envoy-envoy-1 | [2023-06-14 14:37:00.301][18][trace][connection] [source/common/network/connection_impl.cc:679] [C5] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.301][18][trace][connection] [source/common/network/connection_impl.cc:608] [C5] read ready. dispatch_buffered_data=0
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][trace][connection] [source/common/network/raw_buffer_socket.cc:24] [C5] read returns: 120
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][trace][connection] [source/common/network/raw_buffer_socket.cc:38] [C5] read error: Resource temporarily unavailable
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][trace][http] [source/common/http/http1/codec_impl.cc:639] [C5] parsing 120 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][trace][http] [source/common/http/http1/codec_impl.cc:581] [C5] message begin
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][debug][http] [source/common/http/conn_manager_impl.cc:349] [C5] new stream
envoy-envoy-1 | [2023-06-14 14:37:00.302][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:538] [C5] completed header: key=Host value=www.google.com:443
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:538] [C5] completed header: key=User-Agent value=curl/7.88.1
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:832] [C5] onHeadersCompleteBase
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:538] [C5] completed header: key=Proxy-Connection value=Keep-Alive
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:877] [C5] codec entering upgrade mode for CONNECT request.
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][http] [source/common/http/http1/codec_impl.cc:1149] [C5] Server: onHeadersComplete size=3
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][debug][http] [source/common/http/conn_manager_impl.cc:1039] [C5][S17571800918548905256] request headers complete (end_stream=false):
envoy-envoy-1 | ':authority', 'www.google.com:443'
envoy-envoy-1 | ':method', 'CONNECT'
envoy-envoy-1 | 'user-agent', 'curl/7.88.1'
envoy-envoy-1 | 'proxy-connection', 'Keep-Alive'
envoy-envoy-1 |
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][debug][connection] [./source/common/network/connection_impl.h:98] [C5] current connecting state: false
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][debug][rbac] [source/extensions/filters/http/rbac/rbac_filter.cc:114] checking request: requestedServerName: , sourceIP: 172.19.0.1:51394, directRemoteIP: 172.19.0.1:51394, remoteIP: 172.19.0.1:51394,localAddress: 172.19.0.2:10001, ssl: none, headers: ':authority', 'www.google.com:443'
envoy-envoy-1 | ':method', 'CONNECT'
envoy-envoy-1 | ':scheme', 'http'
envoy-envoy-1 | 'user-agent', 'curl/7.88.1'
envoy-envoy-1 | 'x-forwarded-proto', 'http'
envoy-envoy-1 | 'x-request-id', 'f003de2e-ddb5-4d3f-9717-6c7fef73d360'
envoy-envoy-1 | , dynamicMetadata:
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][matcher] [./source/common/matcher/field_matcher.h:152] Attempting to match data input: www.google.com:443
envoy-envoy-1 | [2023-06-14 14:37:00.303][18][trace][matcher] [./source/common/matcher/field_matcher.h:164] Match result: false
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][matcher] [./source/common/matcher/field_matcher.h:152] Attempting to match data input: www.google.com:443
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][matcher] [./source/common/matcher/field_matcher.h:164] Match result: true
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][debug][rbac] [source/extensions/filters/http/rbac/rbac_filter.cc:154] enforced allowed, matched policy allowed
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/filter_manager.cc:539] [C5][S17571800918548905256] decode headers called: filter=envoy.filters.http.rbac status=0
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:89] thread local lookup for host 'www.google.com:443'
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:110] cache miss for host 'www.google.com:443', posting to main thread
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][debug][forward_proxy] [source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc:173] [C5][S17571800918548905256] waiting to load DNS cache entry
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/filter_manager.cc:539] [C5][S17571800918548905256] decode headers called: filter=envoy.filters.http.dynamic_forward_proxy status=4
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/http1/codec_impl.cc:936] [C5] message complete
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/http1/codec_impl.cc:944] [C5] Pausing parser due to upgrade.
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/http1/codec_impl.cc:689] [C5] parsed 120 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/http1/codec_impl.cc:616] [C5] direct-dispatched 0 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/http1/codec_impl.cc:1236] [C5] body size=0
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.304][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.rbac status=0
envoy-envoy-1 | [2023-06-14 14:37:00.304][1][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:293] starting main thread resolve for host='www.google.com:443' dns='www.google.com' port='443'
envoy-envoy-1 | [2023-06-14 14:37:00.304][1][debug][dns] [source/extensions/network/dns_resolver/cares/dns_impl.cc:354] dns resolution for www.google.com started
envoy-envoy-1 | [2023-06-14 14:37:00.304][1][trace][dns] [source/extensions/network/dns_resolver/cares/dns_impl.cc:317] Setting DNS resolution timer for 5000 milliseconds
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][dns] [source/extensions/network/dns_resolver/cares/dns_impl.cc:275] dns resolution for www.google.com completed with status 0
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:317] main thread resolve complete for host 'www.google.com:443': [142.250.74.228:0]
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:391] host 'www.google.com:443' address has changed from to 142.250.74.228:443
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][upstream] [source/extensions/clusters/dynamic_forward_proxy/cluster.cc:109] Adding host info for www.google.com:443
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][upstream] [source/extensions/clusters/dynamic_forward_proxy/cluster.cc:88] adding new dfproxy cluster host 'www.google.com:443'
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][debug][upstream] [source/common/upstream/upstream_impl.cc:457] transport socket match, socket default selected for host with address 142.250.74.228:443
envoy-envoy-1 | [2023-06-14 14:37:00.318][1][trace][upstream] [source/common/upstream/upstream_impl.cc:1877] Local locality:
envoy-envoy-1 | [2023-06-14 14:37:00.318][15][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.318][15][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.318][17][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.318][17][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.318][18][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.318][18][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.319][1][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.319][1][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.319][20][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.319][20][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.319][24][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.319][24][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.319][21][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1211] membership update for TLS cluster dynamic_forward_proxy_cluster added 1 removed 0
envoy-envoy-1 | [2023-06-14 14:37:00.319][21][debug][upstream] [source/common/upstream/cluster_manager_impl.cc:1217] re-creating local LB for TLS cluster dynamic_forward_proxy_cluster
envoy-envoy-1 | [2023-06-14 14:37:00.319][1][debug][forward_proxy] [source/extensions/common/dynamic_forward_proxy/dns_cache_impl.cc:414] DNS refresh rate reset for host 'www.google.com:443', refresh rate 22000 ms
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][debug][forward_proxy] [source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc:223] [C5][S17571800918548905256] load DNS cache complete, continuing after adding resolved host: www.google.com
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][trace][http] [source/common/http/filter_manager.cc:68] [C5][S17571800918548905256] continuing filter chain: filter=0x1533bf920aa0
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][debug][router] [source/common/router/router.cc:478] [C5][S17571800918548905256] cluster 'dynamic_forward_proxy_cluster' match for URL ''
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][debug][misc] [source/common/upstream/cluster_manager_impl.cc:1970] Allocating TCP conn pool
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][debug][router] [source/common/router/router.cc:686] [C5][S17571800918548905256] router decoding headers:
envoy-envoy-1 | ':authority', 'www.google.com:443'
envoy-envoy-1 | ':method', 'CONNECT'
envoy-envoy-1 | ':scheme', 'http'
envoy-envoy-1 | 'user-agent', 'curl/7.88.1'
envoy-envoy-1 | 'x-forwarded-proto', 'http'
envoy-envoy-1 | 'x-request-id', 'f003de2e-ddb5-4d3f-9717-6c7fef73d360'
envoy-envoy-1 | 'x-envoy-expected-rq-timeout-ms', '15000'
envoy-envoy-1 |
envoy-envoy-1 | [2023-06-14 14:37:00.319][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:291] trying to create new connection
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][pool] [source/common/conn_pool/conn_pool_base.cc:292] ConnPoolImplBase 0x1533bf907400, ready_clients_.size(): 0, busy_clients_.size(): 0, connecting_clients_.size(): 0, connecting_stream_capacity_: 0, num_active_streams_: 0, pending_streams_.size(): 1 per upstream preconnect ratio: 1
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:145] creating a new connection (connecting=0)
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][debug][connection] [source/common/network/connection_impl.cc:941] [C6] connecting to 142.250.74.228:443
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][debug][connection] [source/common/network/connection_impl.cc:960] [C6] connection in progress
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][pool] [source/common/conn_pool/conn_pool_base.cc:131] not creating a new connection, shouldCreateNewConnection returned false.
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][http] [source/common/http/filter_manager.cc:539] [C5][S17571800918548905256] decode headers called: filter=envoy.filters.http.upstream_codec status=4
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][http] [source/common/http/filter_manager.cc:539] [C5][S17571800918548905256] decode headers called: filter=envoy.filters.http.router status=1
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.dynamic_forward_proxy status=0
envoy-envoy-1 | [2023-06-14 14:37:00.320][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.router status=3
envoy-envoy-1 | [2023-06-14 14:37:00.331][18][trace][connection] [source/common/network/connection_impl.cc:568] [C6] socket event: 2
envoy-envoy-1 | [2023-06-14 14:37:00.331][18][trace][connection] [source/common/network/connection_impl.cc:679] [C6] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.331][18][debug][connection] [source/common/network/connection_impl.cc:688] [C6] connected
envoy-envoy-1 | [2023-06-14 14:37:00.331][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_handshaker.cc:93] [C6] ssl error occurred while read: WANT_READ
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][connection] [source/common/network/connection_impl.cc:568] [C6] socket event: 3
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][connection] [source/common/network/connection_impl.cc:679] [C6] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:360] [C6] Async cert validation completed
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][connection] [source/common/network/connection_impl.cc:423] [C6] raising connection event 2
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][connection] [source/common/network/connection_impl.cc:362] [C6] readDisable: disable=true disable_count=0 state=0 buffer_length=0
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:328] [C6] attaching to next stream
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:182] [C6] creating stream
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][connection] [source/common/network/connection_impl.cc:362] [C6] readDisable: disable=false disable_count=1 state=0 buffer_length=0
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][debug][router] [source/common/router/upstream_request.cc:650] [C5][S17571800918548905256] pool ready
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][router] [source/common/router/upstream_codec_filter.cc:61] [C5][S17571800918548905256] proxying headers
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][trace][router] [source/common/router/upstream_request.cc:265] [C5][S17571800918548905256] upstream response headers:
envoy-envoy-1 | ':status', '200'
envoy-envoy-1 |
envoy-envoy-1 | [2023-06-14 14:37:00.343][18][debug][router] [source/common/router/router.cc:1442] [C5][S17571800918548905256] upstream headers complete: end_stream=false
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][debug][http] [source/common/http/conn_manager_impl.cc:1680] [C5][S17571800918548905256] encoding headers via codec (end_stream=false):
envoy-envoy-1 | ':status', '200'
envoy-envoy-1 | 'date', 'Wed, 14 Jun 2023 14:36:59 GMT'
envoy-envoy-1 | 'server', 'envoy'
envoy-envoy-1 |
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:483] [C5] writing 71 bytes, end_stream false
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][http] [source/common/http/filter_manager.cc:68] [C5][S17571800918548905256] continuing filter chain: filter=0x1533bf814820
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][router] [source/common/router/upstream_codec_filter.cc:93] [C5][S17571800918548905256] proxying 0 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.upstream_codec status=0
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:608] [C6] read ready. dispatch_buffered_data=0
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:87] [C6] ssl read returns: -1
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:127] [C6] ssl error occurred while read: WANT_READ
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:163] [C6] ssl read 0 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:568] [C6] socket event: 2
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:679] [C6] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:568] [C5] socket event: 2
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/connection_impl.cc:679] [C5] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.344][18][trace][connection] [source/common/network/raw_buffer_socket.cc:67] [C5] write returns: 71
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:568] [C5] socket event: 3
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:679] [C5] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:608] [C5] read ready. dispatch_buffered_data=0
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/raw_buffer_socket.cc:24] [C5] read returns: 324
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/raw_buffer_socket.cc:38] [C5] read error: Resource temporarily unavailable
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/http1/codec_impl.cc:639] [C5] parsing 324 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/http1/codec_impl.cc:616] [C5] direct-dispatched 324 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/http1/codec_impl.cc:1236] [C5] body size=324
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.rbac status=0
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.dynamic_forward_proxy status=0
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][router] [source/common/router/upstream_codec_filter.cc:93] [C5][S17571800918548905256] proxying 324 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:483] [C6] writing 324 bytes, end_stream false
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.upstream_codec status=0
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][http] [source/common/http/filter_manager.cc:671] [C5][S17571800918548905256] decode data called: filter=envoy.filters.http.router status=3
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:568] [C6] socket event: 2
envoy-envoy-1 | [2023-06-14 14:37:00.345][18][trace][connection] [source/common/network/connection_impl.cc:679] [C6] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.346][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:269] [C6] ssl write returns: 324
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/common/network/connection_impl.cc:568] [C6] socket event: 3
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/common/network/connection_impl.cc:679] [C6] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/common/network/connection_impl.cc:608] [C6] read ready. dispatch_buffered_data=0
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:87] [C6] ssl read returns: 179
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:87] [C6] ssl read returns: 0
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:127] [C6] ssl error occurred while read: SYSCALL
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:163] [C6] ssl read 179 bytes
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][router] [source/common/router/upstream_request.cc:557] [C5][S17571800918548905256] resetting pool request
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][connection] [source/common/network/connection_impl.cc:139] [C6] closing data_to_write=0 type=1
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][connection] [source/common/network/connection_impl.cc:250] [C6] closing socket: 1
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:321] [C6] SSL shutdown: rc=0
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][connection] [source/common/network/connection_impl.cc:423] [C6] raising connection event 1
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:484] [C6] client disconnected, failure reason:
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=1)
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:454] invoking idle callbacks - is_draining_for_deletion_=false
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][upstream] [source/common/upstream/cluster_manager_impl.cc:1855] Idle pool, erasing pool for host www.google.com:443
envoy-envoy-1 | [2023-06-14 14:37:00.455][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=2)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:215] [C6] destroying stream: 0 remaining
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][pool] [source/common/conn_pool/conn_pool_base.cc:454] invoking idle callbacks - is_draining_for_deletion_=false
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=3)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=4)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf147d80 for 300000ms, min is 300000ms
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][http] [source/common/http/conn_manager_impl.cc:1690] [C5][S17571800918548905256] encoding data via codec (size=179 end_stream=true)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][connection] [source/common/network/connection_impl.cc:483] [C5] writing 179 bytes, end_stream false
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][http] [source/common/http/conn_manager_impl.cc:1772] [C5][S17571800918548905256] Codec completed encoding stream.
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][http] [source/common/http/conn_manager_impl.cc:215] [C5][S17571800918548905256] doEndStream() resetting stream
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][http] [source/common/http/conn_manager_impl.cc:1736] [C5][S17571800918548905256] stream reset: reset reason: local reset, response details: -
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=5)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][misc] [source/common/event/scaled_range_timer_manager_impl.cc:60] enableTimer called on 0x1533bf014d80 for 3600000ms, min is 3600000ms
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=6)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][connection] [source/common/network/connection_impl.cc:139] [C5] closing data_to_write=179 type=2
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][connection] [source/common/network/connection_impl_base.cc:47] [C5] setting delayed close timer with timeout 1000 ms
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][main] [source/common/event/dispatcher_impl.cc:125] clearing deferred deletion list (size=6)
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][connection] [source/common/network/connection_impl.cc:568] [C5] socket event: 2
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][connection] [source/common/network/connection_impl.cc:679] [C5] write ready
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][trace][connection] [source/common/network/raw_buffer_socket.cc:67] [C5] write returns: 179
envoy-envoy-1 | [2023-06-14 14:37:00.456][18][debug][connection] [source/common/network/connection_impl.cc:720] [C5] write flush complete
envoy-envoy-1 | [2023-06-14 14:37:00.459][18][trace][connection] [source/common/network/connection_impl.cc:568] [C5] socket event: 6
envoy-envoy-1 | [2023-06-14 14:37:00.459][18][debug][connection] [source/common/network/connection_impl.cc:590] [C5] remote early close
envoy-envoy-1 | [2023-06-14 14:37:00.459][18][debug][connection] [source/common/network/connection_impl.cc:250] [C5] closing socket: 0
envoy-envoy-1 | [2023-06-14 14:37:00.459][18][trace][connection] [source/common/network/connection_impl.cc:423] [C5] raising connection event 0
envoy-envoy-1 | [2023-06-14 14:37:00.460][18][trace][conn_handler] [source/extensions/listener_managers/listener_manager/active_stream_listener_base.cc:111] [C5] connection on event 0
envoy-envoy-1 | [2023-06-14 14:37:00.460][18][debug][conn_handler] [source/extensions/listener_managers/listener_manager/active_stream_listener_base.cc:121] [C5] adding to cleanup list
envoy-envoy-1 | [2023-06-14 14:37:00.460][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=1)
envoy-envoy-1 | [2023-06-14 14:37:00.460][18][trace][main] [source/common/event/dispatcher_impl.cc:250] item added to deferred deletion list (size=2)
envoy-envoy-1 | [2023-06-14 14:37:00.460][18][trace][main] [source/common/event/dispatcher_impl.cc:125] clearing deferred deletion list (size=2)
envoy-envoy-1 | [2023-06-14 14:37:01.353][1][debug][main] [source/server/server.cc:265] flushing stats
```